<!DOCTYPE html>
<html>
<head>
  <meta charset="utf-8">
  
  <title>frida-gum代码阅读笔记 | o0xmuhe&#39;s blog</title>
  <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
  <meta name="description" content="0x00 : 前言与预备知识frida :  frida是一个优秀的跨平台Dynamic instrumentation toolkit，具体可以看官网介绍 GObject对象系统">
<meta name="keywords" content="frida">
<meta property="og:type" content="article">
<meta property="og:title" content="frida-gum代码阅读笔记">
<meta property="og:url" content="http:&#x2F;&#x2F;o0xmuhe.me&#x2F;2019&#x2F;11&#x2F;15&#x2F;frida-gum%E4%BB%A3%E7%A0%81%E9%98%85%E8%AF%BB&#x2F;index.html">
<meta property="og:site_name" content="o0xmuhe&#39;s blog">
<meta property="og:description" content="0x00 : 前言与预备知识frida :  frida是一个优秀的跨平台Dynamic instrumentation toolkit，具体可以看官网介绍 GObject对象系统">
<meta property="og:locale" content="default">
<meta property="og:updated_time" content="2019-11-15T11:09:58.548Z">
<meta name="twitter:card" content="summary">
  
    <link rel="alternative" href="/atom.xml" title="o0xmuhe&#39;s blog" type="application/atom+xml">
  
  
    <link rel="icon" href="/img/favicon.png">
  
  
      <link rel="stylesheet" href="//cdn.bootcss.com/animate.css/3.5.0/animate.min.css">
  
  <link rel="stylesheet" href="/css/style.css">
  <link rel="stylesheet" href="/font-awesome/css/font-awesome.min.css">
  <link rel="apple-touch-icon" href="/apple-touch-icon.png">
  
  
      <link rel="stylesheet" href="/fancybox/jquery.fancybox.css">
  
  <!-- 加载特效 -->
    <script src="/js/pace.js"></script>
    <link href="/css/pace/pace-theme-flash.css" rel="stylesheet" />
  <script>
      var yiliaConfig = {
          rootUrl: '/',
          fancybox: true,
          animate: true,
          isHome: false,
          isPost: true,
          isArchive: false,
          isTag: false,
          isCategory: false,
          open_in_new: false
      }
  </script>
</head>
<body>
  <div id="container">
    <div class="left-col">
    <div class="overlay"></div>
<div class="intrude-less">
    <header id="header" class="inner">
        <a href="/" class="profilepic">
            
            <img lazy-src="/img/head.jpg" class="js-avatar">
            
        </a>

        <hgroup>
          <h1 class="header-author"><a href="/" title="Hi Mate">muhe</a></h1>
        </hgroup>

        
        <p class="header-subtitle">control $pc, control the world</p>
        
        
        
            <div id="switch-btn" class="switch-btn">
                <div class="icon">
                    <div class="icon-ctn">
                        <div class="icon-wrap icon-house" data-idx="0">
                            <div class="birdhouse"></div>
                            <div class="birdhouse_holes"></div>
                        </div>
                        <div class="icon-wrap icon-ribbon hide" data-idx="1">
                            <div class="ribbon"></div>
                        </div>
                        
                        <div class="icon-wrap icon-link hide" data-idx="2">
                            <div class="loopback_l"></div>
                            <div class="loopback_r"></div>
                        </div>
                        
                        
                        <div class="icon-wrap icon-me hide" data-idx="3">
                            <div class="user"></div>
                            <div class="shoulder"></div>
                        </div>
                        
                    </div>
                    
                </div>
                <div class="tips-box hide">
                    <div class="tips-arrow"></div>
                    <ul class="tips-inner">
                        <li>菜单</li>
                        <li>标签</li>
                        
                        <li>友情链接</li>
                        
                        
                        <li>关于我</li>
                        
                    </ul>
                </div>
            </div>
        

        <div id="switch-area" class="switch-area">
            <div class="switch-wrap">
                <section class="switch-part switch-part1">
                    <nav class="header-menu">
                        <ul>
                        
                            <li><a href="/">博客首页</a></li>
                        
                            <li><a href="/archives">所有文章</a></li>
                        
                            <li><a href="/frinds">友情链接</a></li>
                        
                            <li><a href="/about">关于我</a></li>
                        
                            <li><a href="/Pwnable-Log">Pwnable</a></li>
                        
                        </ul>
                    </nav>
                    <nav class="header-nav">
                        <ul class="social">
                            
                                <a class="fl github" target="_blank" href="https://github.com/o0xmuhe" title="github">github</a>
                            
                                <a class="fl weibo" target="_blank" href="http://weibo.com/2070174943/" title="weibo">weibo</a>
                            
                                <a class="fl twitter" target="_blank" href="https://twitter.com/0xmuhe" title="twitter">twitter</a>
                            
                                <a class="fl rss" target="_blank" href="/atom.xml" title="rss">rss</a>
                            
                        </ul>
                    </nav>
                </section>
                
                
                <section class="switch-part switch-part2">
                    <div class="widget tagcloud" id="js-tagcloud">
                        <a href="/tags/1day/" style="font-size: 10px;">1day</a> <a href="/tags/Adobe/" style="font-size: 11.43px;">Adobe</a> <a href="/tags/Adobe-Acrobat-Reader/" style="font-size: 10px;">Adobe Acrobat Reader</a> <a href="/tags/Adobe-Reader/" style="font-size: 11.43px;">Adobe Reader</a> <a href="/tags/Antlr/" style="font-size: 10px;">Antlr</a> <a href="/tags/Apple/" style="font-size: 10px;">Apple</a> <a href="/tags/Bindiff/" style="font-size: 10px;">Bindiff</a> <a href="/tags/C/" style="font-size: 11.43px;">C</a> <a href="/tags/CTF/" style="font-size: 10px;">CTF</a> <a href="/tags/CTF-Writeup/" style="font-size: 10px;">CTF Writeup</a> <a href="/tags/CVE/" style="font-size: 10px;">CVE</a> <a href="/tags/Compilers/" style="font-size: 10px;">Compilers</a> <a href="/tags/ESXi/" style="font-size: 10px;">ESXi</a> <a href="/tags/Frida/" style="font-size: 10px;">Frida</a> <a href="/tags/IDA/" style="font-size: 12.86px;">IDA</a> <a href="/tags/IPC/" style="font-size: 11.43px;">IPC</a> <a href="/tags/LLVM/" style="font-size: 10px;">LLVM</a> <a href="/tags/Linux/" style="font-size: 12.86px;">Linux</a> <a href="/tags/MacOS/" style="font-size: 11.43px;">MacOS</a> <a href="/tags/Mach/" style="font-size: 10px;">Mach</a> <a href="/tags/PANDA/" style="font-size: 10px;">PANDA</a> <a href="/tags/PoC/" style="font-size: 11.43px;">PoC</a> <a href="/tags/Python/" style="font-size: 10px;">Python</a> <a href="/tags/RE/" style="font-size: 10px;">RE</a> <a href="/tags/Snell/" style="font-size: 10px;">Snell</a> <a href="/tags/Study/" style="font-size: 15.71px;">Study</a> <a href="/tags/Surge/" style="font-size: 10px;">Surge</a> <a href="/tags/Symbolic-Execution/" style="font-size: 10px;">Symbolic Execution</a> <a href="/tags/Tools/" style="font-size: 11.43px;">Tools</a> <a href="/tags/UaF/" style="font-size: 10px;">UaF</a> <a href="/tags/Webkit/" style="font-size: 10px;">Webkit</a> <a href="/tags/android/" style="font-size: 10px;">android</a> <a href="/tags/angr/" style="font-size: 11.43px;">angr</a> <a href="/tags/compiler/" style="font-size: 10px;">compiler</a> <a href="/tags/ctf/" style="font-size: 18.57px;">ctf</a> <a href="/tags/ctf-writeup/" style="font-size: 20px;">ctf writeup</a> <a href="/tags/debug/" style="font-size: 10px;">debug</a> <a href="/tags/env-config/" style="font-size: 10px;">env config</a> <a href="/tags/exploit/" style="font-size: 15.71px;">exploit</a> <a href="/tags/frida/" style="font-size: 10px;">frida</a> <a href="/tags/fuzz/" style="font-size: 14.29px;">fuzz</a> <a href="/tags/gdb/" style="font-size: 10px;">gdb</a> <a href="/tags/glibc%E5%86%85%E5%AD%98%E7%AE%A1%E7%90%86/" style="font-size: 10px;">glibc内存管理</a> <a href="/tags/life/" style="font-size: 11.43px;">life</a> <a href="/tags/linux/" style="font-size: 10px;">linux</a> <a href="/tags/linux-kernel/" style="font-size: 12.86px;">linux kernel</a> <a href="/tags/macOS/" style="font-size: 17.14px;">macOS</a> <a href="/tags/mips/" style="font-size: 10px;">mips</a> <a href="/tags/paper/" style="font-size: 10px;">paper</a> <a href="/tags/peach/" style="font-size: 10px;">peach</a> <a href="/tags/pwn/" style="font-size: 15.71px;">pwn</a> <a href="/tags/python/" style="font-size: 10px;">python</a> <a href="/tags/ret-2-dl-resolve/" style="font-size: 10px;">ret 2 dl-resolve</a> <a href="/tags/study/" style="font-size: 12.86px;">study</a> <a href="/tags/tools/" style="font-size: 10px;">tools</a> <a href="/tags/uaf/" style="font-size: 10px;">uaf</a> <a href="/tags/unicorn-engine/" style="font-size: 10px;">unicorn engine</a> <a href="/tags/vuln-analysis/" style="font-size: 10px;">vuln analysis</a> <a href="/tags/wargame/" style="font-size: 11.43px;">wargame</a> <a href="/tags/webkit/" style="font-size: 12.86px;">webkit</a> <a href="/tags/winafl/" style="font-size: 10px;">winafl</a> <a href="/tags/windows-kernel/" style="font-size: 12.86px;">windows kernel</a> <a href="/tags/writeup/" style="font-size: 10px;">writeup</a> <a href="/tags/%E5%85%B6%E4%BB%96/" style="font-size: 10px;">其他</a> <a href="/tags/%E5%B7%A5%E5%85%B7/" style="font-size: 10px;">工具</a> <a href="/tags/%E6%84%9F%E6%82%9F/" style="font-size: 10px;">感悟</a> <a href="/tags/%E6%84%9F%E6%83%B3/" style="font-size: 10px;">感想</a> <a href="/tags/%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/" style="font-size: 15.71px;">漏洞分析</a> <a href="/tags/%E7%8E%AF%E5%A2%83%E9%85%8D%E7%BD%AE/" style="font-size: 11.43px;">环境配置</a> <a href="/tags/%E7%BC%96%E8%AF%91%E5%8E%9F%E7%90%86/" style="font-size: 11.43px;">编译原理</a>
                    </div>
                </section>
                
                
                
                <section class="switch-part switch-part3">
                    <div id="js-friends">
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="http://syclover.sinaapp.com/">Syclover Team</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="https://weibo.com/u/5376172367">最爱的高老师</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="http://www.Ox9A82.com">0x9A82学弟</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="http://k1n9.me/">K1n9师傅</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="http://www.cnblogs.com/iamstudy">L3mon</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="http://www.xianyusec.com">咸鱼</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="http://rootclay.com">rootclay</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="http://v1ct0r.com/">V1ct0r</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="http://godot.win">Godot学弟</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="http://hebic.me/">Homaebic学弟</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="https://iqwq.me">两米的sco4x0</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="https://zmy.im/">JimmyZhou</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="http://silic.top/">灭亡叔叔</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="https://dwx.io">Jason</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="	http://www.0aa.me/">Mosuan</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="http://whereisk0shl.top">k0sh1</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="http://winter3un.github.io">WinterSun</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="http://venenof.com">Venenof</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="http://r0p.me/">Icemakr</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="http://bestwing.me/">Swing</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="https://www.hackfun.org/">4ido10n</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="http://www.hackersb.cn/">王松_Striker</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="http://www.cnblogs.com/7top/">7top</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="http://www.bendawang.site">bendawang</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="http://yixuankeer.win">前端joker大佬</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="http://blog.lc4t.me">lc4t</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="http://www.inksec.cn/">Szrzvdny</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="http://sixwha1e.github.io/">漂亮的sixwhale小姐姐</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="http://ctfrank.org">CTF Rank</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="http://askook.me/">A酱</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="/idoge.cc">重庆五套房的小葱</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="/stone.moe">石头</a>
                    
                      <a target="_blank" class="main-nav-link switch-friends-link" href="/pi4net.com">邢老师最优秀</a>
                    
                    </div>
                </section>
                

                
                
                <section class="switch-part switch-part4">
                
                    <div id="js-aboutme">二进制安全. Member of Syclover. CTFer/INTJ.</div>
                </section>
                
            </div>
        </div>
    </header>                
</div>
    </div>
    <div class="mid-col">
      <nav id="mobile-nav">
      <div class="overlay">
          <div class="slider-trigger"></div>
          <h1 class="header-author js-mobile-header hide"><a href="/" title="Me">muhe</a></h1>
      </div>
    <div class="intrude-less">
        <header id="header" class="inner">
            <a href="/" class="profilepic">
                
                    <img lazy-src="/img/head.jpg" class="js-avatar">
                
            </a>
            <hgroup>
              <h1 class="header-author"><a href="/" title="Me">muhe</a></h1>
            </hgroup>
            
            <p class="header-subtitle">control $pc, control the world</p>
            
            <nav class="header-menu">
                <ul>
                
                    <li><a href="/">博客首页</a></li>
                
                    <li><a href="/archives">所有文章</a></li>
                
                    <li><a href="/frinds">友情链接</a></li>
                
                    <li><a href="/about">关于我</a></li>
                
                    <li><a href="/Pwnable-Log">Pwnable</a></li>
                
                <div class="clearfix"></div>
                </ul>
            </nav>
            <nav class="header-nav">
                <div class="social">
                    
                        <a class="github" target="_blank" href="https://github.com/o0xmuhe" title="github">github</a>
                    
                        <a class="weibo" target="_blank" href="http://weibo.com/2070174943/" title="weibo">weibo</a>
                    
                        <a class="twitter" target="_blank" href="https://twitter.com/0xmuhe" title="twitter">twitter</a>
                    
                        <a class="rss" target="_blank" href="/atom.xml" title="rss">rss</a>
                    
                </div>
            </nav>
        </header>                
    </div>
</nav>
      <div class="body-wrap"><article id="post-frida-gum代码阅读" class="article article-type-post" itemscope itemprop="blogPost">
  
    <div class="article-meta">
      <a href="/2019/11/15/frida-gum%E4%BB%A3%E7%A0%81%E9%98%85%E8%AF%BB/" class="article-date">
      <time datetime="2019-11-15T09:54:02.000Z" itemprop="datePublished">2019-11-15</time>
</a>
    </div>
  
  <div class="article-inner">
    
      <input type="hidden" class="isFancy" />
    
    
      <header class="article-header">
        
  
    <h1 class="article-title" itemprop="name">
      frida-gum代码阅读笔记
    </h1>
  

      </header>
      
      <div class="article-info article-info-post">
        

        
    <div class="article-tag tagcloud">
        <ul class="article-tag-list" itemprop="keywords"><li class="article-tag-list-item"><a class="article-tag-list-link" href="/tags/frida/" rel="tag">frida</a></li></ul>
    </div>

        <div class="clearfix"></div>
      </div>
      
    
    <div class="article-entry" itemprop="articleBody">
      
          
        <h2 id="0x00-前言与预备知识"><a href="#0x00-前言与预备知识" class="headerlink" title="0x00 : 前言与预备知识"></a>0x00 : 前言与预备知识</h2><p><code>frida</code> :  frida是一个优秀的跨平台<code>Dynamic instrumentation toolkit</code>，具体可以看<a href="https://www.frida.re" target="_blank" rel="noopener">官网介绍</a></p>
<p><a href="https://www.ibm.com/developerworks/cn/linux/l-gobject/index.html" target="_blank" rel="noopener">GObject对象系统</a></p>
<a id="more"></a>

<p>GObject这个比较重要，因为frida框架底层的hook框架Frida-gum是纯c写的，为了实现一些面向对象的编程，使用了Gobject。</p>
<h2 id="0x01-项目构架"><a href="#0x01-项目构架" class="headerlink" title="0x01 : 项目构架"></a>0x01 : 项目构架</h2><p>直接拉下来的代码如下</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br></pre></td><td class="code"><pre><span class="line">╭─muhe@muheMacBookPro ~/Code/frida ‹master*›</span><br><span class="line">╰─$ l</span><br><span class="line">total 137608</span><br><span class="line">drwxr-xr-x  29 muhe  staff   928B Nov 13 17:22 .</span><br><span class="line">drwxr-xr-x  90 muhe  staff   2.8K Nov  5 16:44 ..</span><br><span class="line">drwxr-xr-x  15 muhe  staff   480B Nov 15 18:23 .git</span><br><span class="line">-rw-r--r--   1 muhe  staff   383B Jan 21  2019 .gitignore</span><br><span class="line">-rw-r--r--   1 muhe  staff   886B Jan 21  2019 .gitmodules</span><br><span class="line">drwxr-xr-x   3 muhe  staff    96B Nov 13 17:22 .vscode</span><br><span class="line">-rw-r--r--   1 muhe  staff   2.4K Jan 21  2019 COPYING</span><br><span class="line">-rw-r--r--   1 muhe  staff   1.2K Nov  7 18:11 Makefile</span><br><span class="line">-rw-r--r--   1 muhe  staff    28K Nov  7 18:11 Makefile.linux.mk</span><br><span class="line">-rw-r--r--   1 muhe  staff    28K Nov  7 18:11 Makefile.macos.mk</span><br><span class="line">-rw-r--r--   1 muhe  staff    21K Nov  7 18:11 Makefile.sdk.mk</span><br><span class="line">-rw-r--r--   1 muhe  staff    84K Apr 29  2019 Makefile.toolchain.mk</span><br><span class="line">-rw-r--r--   1 muhe  staff   1.7K Nov  7 18:11 README.md</span><br><span class="line">drwxr-xr-x  10 muhe  staff   320B Nov 11 14:59 build</span><br><span class="line">drwxr-xr-x  61 muhe  staff   1.9K Jan 21  2019 capstone</span><br><span class="line">-rw-r--r--   1 muhe  staff   1.0K Nov  7 18:11 config.mk</span><br><span class="line">drwxr-xr-x   9 muhe  staff   288B Jan 21  2019 frida-clr</span><br><span class="line">drwxr-xr-x  21 muhe  staff   672B Jan 21  2019 frida-core</span><br><span class="line">drwxr-xr-x  20 muhe  staff   640B Nov 11 17:37 frida-gum</span><br><span class="line">drwxr-xr-x  15 muhe  staff   480B Jan 21  2019 frida-node</span><br><span class="line">drwxr-xr-x  20 muhe  staff   640B Jan 21  2019 frida-python</span><br><span class="line">drwxr-xr-x  27 muhe  staff   864B Jan 21  2019 frida-qml</span><br><span class="line">drwxr-xr-x  10 muhe  staff   320B Jan 21  2019 frida-swift</span><br><span class="line">drwxr-xr-x  12 muhe  staff   384B Jan 21  2019 frida-tools</span><br><span class="line">-rw-r--r--   1 muhe  staff    25K Nov  7 18:11 frida.sln</span><br><span class="line">-rw-r--r--   1 muhe  staff   9.0K Nov 11 14:43 frida.srctrlbm</span><br><span class="line">-rw-r--r--   1 muhe  staff    67M Nov 11 14:43 frida.srctrldb</span><br><span class="line">-rw-r--r--   1 muhe  staff   6.1K Nov 11 14:35 frida.srctrlprj</span><br><span class="line">drwxr-xr-x  47 muhe  staff   1.5K Nov  7 18:11 releng</span><br></pre></td></tr></table></figure>

<p><code>frida-gum</code>是底层hook框架，跨平台；</p>
<p><code>frida-python</code> , <code>frida-node</code>啥的是 bindings，暂时不管，不理解原理看也看不懂；</p>
<p><code>capstone</code> 牛逼的反汇编框架，<code>frida-gum</code>中用到了，用于指令的读；</p>
<p><code>releng</code> 编译相关的；</p>
<p><code>frida-core</code>  server/agent相关；</p>
<p><code>frida-tools</code> 一些工具，比如frida-ps啥的。</p>
<p>重点是<code>frida-gum</code> ，这是理解这个框架的基础。</p>
<h2 id="0x02-阅读frida-gum-x86为例"><a href="#0x02-阅读frida-gum-x86为例" class="headerlink" title="0x02 : 阅读frida-gum (x86为例)"></a>0x02 : 阅读<code>frida-gum</code> (x86为例)</h2><p><code>frida-gum</code> 注释并不多，甚至可以说几乎没，好在他代码写得好，构架合理代码规范好，所以阅读起来多读几遍，总会看懂的。</p>
<h3 id="2-1-构架"><a href="#2-1-构架" class="headerlink" title="2.1. 构架"></a>2.1. 构架</h3><p>这个的框架的构架如下：</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><span class="line">total 200</span><br><span class="line">drwxr-xr-x  20 muhe  staff   640B Nov 11 17:37 .</span><br><span class="line">drwxr-xr-x  29 muhe  staff   928B Nov 13 17:22 ..</span><br><span class="line">-rw-r--r--   1 muhe  staff    34B Jan 21  2019 .git</span><br><span class="line">-rw-r--r--   1 muhe  staff    70B Jan 21  2019 .gitignore</span><br><span class="line">drwxr-xr-x   3 muhe  staff    96B Nov 11 17:37 .vscode</span><br><span class="line">-rw-r--r--   1 muhe  staff   5.6K Jan 21  2019 COPYING</span><br><span class="line">drwxr-xr-x   5 muhe  staff   160B Jan 21  2019 bindings</span><br><span class="line">-rw-r--r--   1 muhe  staff   2.1K Jan 21  2019 config.h.in</span><br><span class="line">drwxr-xr-x   3 muhe  staff    96B Jan 21  2019 ext</span><br><span class="line">drwxr-xr-x  85 muhe  staff   2.7K Jan 21  2019 gum</span><br><span class="line">-rw-r--r--   1 muhe  staff   5.1K Jan 21  2019 gum-32.vcxproj</span><br><span class="line">-rw-r--r--   1 muhe  staff    16K Jan 21  2019 gum-32.vcxproj.filters</span><br><span class="line">-rw-r--r--   1 muhe  staff   5.1K Jan 21  2019 gum-64.vcxproj</span><br><span class="line">-rw-r--r--   1 muhe  staff    16K Jan 21  2019 gum-64.vcxproj.filters</span><br><span class="line">-rw-r--r--   1 muhe  staff   8.5K Jan 21  2019 gum-common.props</span><br><span class="line">drwxr-xr-x   4 muhe  staff   128B Jan 21  2019 libs</span><br><span class="line">-rw-r--r--   1 muhe  staff   6.8K Jan 21  2019 meson.build</span><br><span class="line">-rw-r--r--   1 muhe  staff   190B Jan 21  2019 meson_options.txt</span><br><span class="line">drwxr-xr-x  28 muhe  staff   896B Jan 21  2019 tests</span><br><span class="line">drwxr-xr-x   7 muhe  staff   224B Jan 21  2019 vapi</span><br></pre></td></tr></table></figure>

<p>核心是在gum目录下</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line">gum</span><br><span class="line">├── arch-arm</span><br><span class="line">├── arch-arm64</span><br><span class="line">├── arch-mips</span><br><span class="line">├── arch-x86</span><br><span class="line">├── backend-arm</span><br><span class="line">├── backend-arm64</span><br><span class="line">├── backend-darwin</span><br><span class="line">├── backend-dbghelp</span><br><span class="line">├── backend-elf</span><br><span class="line">├── backend-libdwarf</span><br><span class="line">├── backend-libunwind</span><br><span class="line">├── backend-linux</span><br><span class="line">├── backend-mips</span><br><span class="line">├── backend-posix</span><br><span class="line">├── backend-qnx</span><br><span class="line">├── backend-windows</span><br><span class="line">└── backend-x86</span><br><span class="line">....// gum下其他文件</span><br></pre></td></tr></table></figure>

<p>这里有必要说一下，<code>frida-gum</code> 为了实现跨平台，抽象出来 <code>构架无关/平台无关/系统无关</code>的api，比如一些内存操作，在<code>frida-gum</code>里可能就是<code>gum_xxxxx</code>，但是根据不同平台，调用到对应平台的api里去，正是做了很好的封装，上层代码才会看起来“平台无关”。</p>
<p>还有几个核心的对象，后面的代码里频繁提及：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line"><span class="class"><span class="keyword">struct</span> _<span class="title">GumInterceptor</span></span></span><br><span class="line"><span class="class">&#123;</span></span><br><span class="line">  GObject parent;</span><br><span class="line"></span><br><span class="line">  GRecMutex mutex;</span><br><span class="line"></span><br><span class="line">  GHashTable * function_by_address;</span><br><span class="line"></span><br><span class="line">  GumInterceptorBackend * backend;</span><br><span class="line">  GumCodeAllocator allocator;</span><br><span class="line"></span><br><span class="line">  <span class="keyword">volatile</span> guint selected_thread_id;</span><br><span class="line"></span><br><span class="line">  GumInterceptorTransaction current_transaction;</span><br><span class="line">&#125;;</span><br></pre></td></tr></table></figure>

<p>从这个拦截器类索引出去的对象都需要好好注意，比如 <code>GumInterceptorBackend</code> , 最好可以生成一个uml图，阅读代码的时候对比着看。</p>
<h3 id="2-2-代码阅读"><a href="#2-2-代码阅读" class="headerlink" title="2.2. 代码阅读"></a>2.2. 代码阅读</h3><h4 id="2-2-1-准备工作"><a href="#2-2-1-准备工作" class="headerlink" title="2.2.1 准备工作"></a>2.2.1 准备工作</h4><p>面对比较大的代码，重要的是找到一个入口，从这个点开始读，我这里大概看了下单元测试的代码，发现基本是: 初始化，测试各种功能，清理，退出。</p>
<p>那么我的阅读思路就是 : </p>
<ol>
<li>初始化部分</li>
<li>各种功能，比如 内存模块，指令读写模块，代码修复模块</li>
<li>清理 这部分大概过一下就行</li>
</ol>
<p>这里我参考了 <code>jmpews</code>师傅的关于设计hook框架的文章，了解一个hook框架如何设计，分哪些模块，在阅读代码的时候能够有针对性一些。</p>
<ul>
<li>内存分配 模块 </li>
<li>指令写 模块 </li>
<li>指令读 模块 </li>
<li>指令修复 模块 relocator </li>
<li>跳板 模块 </li>
<li>调度器 模块 enter_thunk部分实现 </li>
<li>栈 模块</li>
</ul>
<p>具体可以参考他的文章: <a href="https://bbs.pediy.com/thread-220794.htm" target="_blank" rel="noopener">如何构建一款像 frida 一样的框架</a></p>
<h4 id="2-2-2-hook从0到1"><a href="#2-2-2-hook从0到1" class="headerlink" title="2.2.2 hook从0到1"></a>2.2.2 hook从0到1</h4><p>阅读顺序根据单元测试<code>gum-test.c</code>确定的，具体的可以看代码</p>
<h5 id="gum-interceptor-obtain"><a href="#gum-interceptor-obtain" class="headerlink" title="gum_interceptor_obtain()"></a>gum_interceptor_obtain()</h5><p>这部分是 拦截器初始化</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">// 初始化 interceptor 对象初始化</span></span><br><span class="line">GumInterceptor *</span><br><span class="line">gum_interceptor_obtain (<span class="keyword">void</span>)</span><br><span class="line">&#123;</span><br><span class="line">  GumInterceptor * interceptor;</span><br><span class="line"></span><br><span class="line">  g_mutex_lock (&amp;_gum_interceptor_lock);</span><br><span class="line"></span><br><span class="line">  <span class="keyword">if</span> (_the_interceptor != <span class="literal">NULL</span>)</span><br><span class="line">  &#123;</span><br><span class="line">    interceptor = GUM_INTERCEPTOR (g_object_ref (_the_interceptor));</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">  &#123;</span><br><span class="line">    _the_interceptor = g_object_new (GUM_TYPE_INTERCEPTOR, <span class="literal">NULL</span>);</span><br><span class="line">    g_object_weak_ref (G_OBJECT (_the_interceptor),</span><br><span class="line">        the_interceptor_weak_notify, <span class="literal">NULL</span>);</span><br><span class="line"></span><br><span class="line">    interceptor = _the_interceptor;</span><br><span class="line">  &#125;</span><br><span class="line"></span><br><span class="line">  g_mutex_unlock (&amp;_gum_interceptor_lock);</span><br><span class="line"></span><br><span class="line">  <span class="keyword">return</span> interceptor;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="keyword">static</span> <span class="keyword">void</span></span><br><span class="line">gum_interceptor_init (GumInterceptor * self)</span><br><span class="line">&#123;</span><br><span class="line">  g_rec_mutex_init (&amp;self-&gt;mutex);</span><br><span class="line"></span><br><span class="line">  self-&gt;function_by_address = g_hash_table_new_full (<span class="literal">NULL</span>, <span class="literal">NULL</span>, <span class="literal">NULL</span>,</span><br><span class="line">      (GDestroyNotify) gum_function_context_destroy);</span><br><span class="line"></span><br><span class="line">4<span class="comment">// 分配器初始化</span></span><br><span class="line">  gum_code_allocator_init (&amp;self-&gt;allocator, GUM_INTERCEPTOR_CODE_SLICE_SIZE);</span><br><span class="line"></span><br><span class="line">  <span class="comment">// 创建拦截器后端</span></span><br><span class="line">  self-&gt;backend = _gum_interceptor_backend_create (&amp;self-&gt;allocator);</span><br><span class="line"></span><br><span class="line">  gum_interceptor_transaction_init (&amp;self-&gt;current_transaction, self);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>因为GObject的使用，<code>gum_interceptor_init</code> 这个构造函数，在 <code>interceptor</code>对象创建出来的时候触发。</p>
<p>重点看拦截器后端的初始化</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line">GumInterceptorBackend *</span><br><span class="line">_gum_interceptor_backend_create (GumCodeAllocator * allocator)</span><br><span class="line">&#123;</span><br><span class="line">  GumInterceptorBackend * backend;</span><br><span class="line"></span><br><span class="line">  backend = g_slice_new (GumInterceptorBackend);</span><br><span class="line">  backend-&gt;allocator = allocator;</span><br><span class="line"></span><br><span class="line">  <span class="comment">//初始化 codewriter和relocator</span></span><br><span class="line">  gum_x86_writer_init (&amp;backend-&gt;writer, <span class="literal">NULL</span>);</span><br><span class="line">  gum_x86_relocator_init (&amp;backend-&gt;relocator, <span class="literal">NULL</span>, &amp;backend-&gt;writer);</span><br><span class="line"></span><br><span class="line">  <span class="comment">// 创建 thunk</span></span><br><span class="line">  gum_interceptor_backend_create_thunks (backend);</span><br><span class="line"></span><br><span class="line">  <span class="keyword">return</span> backend;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>这里初始化的<code>writer</code>和<code>relocator</code>分别用于指令写和指令恢复。</p>
<p><code>thunks</code>的初始化，这两个是用于调度执行，分别对应 进入hook和离开hook。</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">static</span> <span class="keyword">void</span></span><br><span class="line">gum_interceptor_backend_create_thunks (GumInterceptorBackend * self)</span><br><span class="line">&#123;</span><br><span class="line">  GumX86Writer * cw = &amp;self-&gt;writer;</span><br><span class="line"></span><br><span class="line">  self-&gt;enter_thunk = gum_code_allocator_alloc_slice (self-&gt;allocator);</span><br><span class="line">  gum_x86_writer_reset (cw, self-&gt;enter_thunk-&gt;data);</span><br><span class="line">  gum_emit_enter_thunk (cw);</span><br><span class="line">  gum_x86_writer_flush (cw);</span><br><span class="line">  g_assert_cmpuint (gum_x86_writer_offset (cw), &lt;=, self-&gt;enter_thunk-&gt;<span class="built_in">size</span>);</span><br><span class="line"></span><br><span class="line">  self-&gt;leave_thunk = gum_code_allocator_alloc_slice (self-&gt;allocator);</span><br><span class="line">  gum_x86_writer_reset (cw, self-&gt;leave_thunk-&gt;data);</span><br><span class="line">  gum_emit_leave_thunk (cw);</span><br><span class="line">  gum_x86_writer_flush (cw);</span><br><span class="line">  g_assert_cmpuint (gum_x86_writer_offset (cw), &lt;=, self-&gt;leave_thunk-&gt;<span class="built_in">size</span>);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>因为原理类似，只举例<code>enter_thunk</code></p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">static</span> <span class="keyword">void</span></span><br><span class="line">gum_emit_enter_thunk (GumX86Writer * cw)</span><br><span class="line">&#123;</span><br><span class="line">  <span class="keyword">const</span> gssize return_address_stack_displacement = <span class="number">0</span>;</span><br><span class="line">  <span class="comment">// save ret addr</span></span><br><span class="line">  gum_emit_prolog (cw, return_address_stack_displacement);</span><br><span class="line"></span><br><span class="line">  <span class="comment">// 构造自己的函数栈</span></span><br><span class="line">  gum_x86_writer_put_lea_reg_reg_offset (cw, GUM_REG_XSI,</span><br><span class="line">      GUM_REG_XBP, GUM_FRAME_OFFSET_CPU_CONTEXT);</span><br><span class="line">  gum_x86_writer_put_lea_reg_reg_offset (cw, GUM_REG_XDX,</span><br><span class="line">      GUM_REG_XBP, GUM_FRAME_OFFSET_TOP);</span><br><span class="line">  gum_x86_writer_put_lea_reg_reg_offset (cw, GUM_REG_XCX,</span><br><span class="line">      GUM_REG_XBP, GUM_FRAME_OFFSET_NEXT_HOP);</span><br><span class="line"></span><br><span class="line">  gum_x86_writer_put_call_address_with_aligned_arguments (cw, GUM_CALL_CAPI,</span><br><span class="line">      GUM_ADDRESS (_gum_function_context_begin_invocation), <span class="number">4</span>,</span><br><span class="line">      GUM_ARG_REGISTER, GUM_REG_XBX,</span><br><span class="line">      GUM_ARG_REGISTER, GUM_REG_XSI,</span><br><span class="line">      GUM_ARG_REGISTER, GUM_REG_XDX,</span><br><span class="line">      GUM_ARG_REGISTER, GUM_REG_XCX);</span><br><span class="line"></span><br><span class="line">  gum_emit_epilog (cw);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<h5 id="gum-interceptor-attach-listener"><a href="#gum-interceptor-attach-listener" class="headerlink" title="gum_interceptor_attach_listener"></a>gum_interceptor_attach_listener</h5><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line">GumAttachReturn</span><br><span class="line">gum_interceptor_attach_listener (GumInterceptor * self,</span><br><span class="line">                                 gpointer function_address,</span><br><span class="line">                                 GumInvocationListener * listener,</span><br><span class="line">                                 gpointer listener_function_data)</span><br><span class="line">&#123;</span><br><span class="line"></span><br><span class="line">...</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<h6 id="gum-interceptor-transaction-begin"><a href="#gum-interceptor-transaction-begin" class="headerlink" title="gum_interceptor_transaction_begin"></a>gum_interceptor_transaction_begin</h6><h6 id="gum-interceptor-instrument-✨"><a href="#gum-interceptor-instrument-✨" class="headerlink" title="gum_interceptor_instrument ✨"></a>gum_interceptor_instrument ✨</h6><p>这里要说的是 function_address 就是要hook的目标函数，<code>frida-gum</code>把要hook的目标封装成了 <code>GumFunctionContext</code>对象，方便操作</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">function_address = gum_interceptor_resolve (self, function_address); <span class="comment">// ?</span></span><br><span class="line">  <span class="comment">// 创建跳板</span></span><br><span class="line">  function_ctx = gum_interceptor_instrument (self, function_address);</span><br></pre></td></tr></table></figure>

<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">static</span> GumFunctionContext *</span><br><span class="line">gum_interceptor_instrument (GumInterceptor * self,</span><br><span class="line">                            gpointer function_address)</span><br><span class="line">&#123;</span><br><span class="line">  GumFunctionContext * ctx;</span><br><span class="line">  </span><br><span class="line">  <span class="comment">// 要hook的函数，封装成了 GumFunctionContext，此时</span></span><br><span class="line">  <span class="comment">// 根据 地址，得到与之对应的 GunFunctionContext对象</span></span><br><span class="line">  ctx = (GumFunctionContext *) g_hash_table_lookup (self-&gt;function_by_address,</span><br><span class="line">      function_address);</span><br><span class="line">  <span class="keyword">if</span> (ctx != <span class="literal">NULL</span>)</span><br><span class="line">    <span class="keyword">return</span> ctx;</span><br><span class="line">  <span class="comment">// 如果获取到的是空的对象，必须初始化了才能使用</span></span><br><span class="line">  <span class="comment">// 只写几个字断，分配内存/hook的函数地址/interceptor成员</span></span><br><span class="line">  ctx = gum_function_context_new (self, function_address);</span><br><span class="line">  <span class="keyword">if</span> (ctx == <span class="literal">NULL</span>)</span><br><span class="line">    <span class="keyword">return</span> <span class="literal">NULL</span>;</span><br><span class="line">  <span class="comment">// 创建跳板</span></span><br><span class="line">  <span class="keyword">if</span> (!_gum_interceptor_backend_create_trampoline (self-&gt;backend, ctx))</span><br><span class="line">  &#123;</span><br><span class="line">    gum_function_context_finalize (ctx);</span><br><span class="line">    <span class="keyword">return</span> <span class="literal">NULL</span>;</span><br><span class="line">  &#125;</span><br><span class="line"></span><br><span class="line">  <span class="comment">// 设置完成后， 添加到哈希表</span></span><br><span class="line">  <span class="comment">// hash_table, key, value</span></span><br><span class="line">  <span class="comment">// hook函数地址，GumFunctionContext对象对应， 方便查找</span></span><br><span class="line">  g_hash_table_insert (self-&gt;function_by_address, function_address, ctx);</span><br><span class="line"></span><br><span class="line">  <span class="comment">// 当前 transaction 添加到 任务中， 设置回调 函数 gum_interceptor_activate 拦截器激活函数</span></span><br><span class="line">  gum_interceptor_transaction_schedule_prologue_write (</span><br><span class="line">      &amp;self-&gt;current_transaction, ctx, gum_interceptor_activate);</span><br><span class="line"></span><br><span class="line">  <span class="keyword">return</span> ctx;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>这里贴一下跳板代码方便理解：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">00C30200  mov         al,byte ptr ds:[FF00C121h]  </span><br><span class="line">00C30205  xor         eax,0C30200h  </span><br><span class="line">00C3020A  jmp         00C30000   // 跳到上面的 enter_thunk</span><br><span class="line">00C3020F  push        dword ptr ds:[0C30200h]  </span><br><span class="line">00C30215  jmp         00C30100  // 跳到 leave_thunk</span><br><span class="line">// 原函数修复的指令，7个字节</span><br><span class="line">00C3021A  push        ebp  </span><br><span class="line">00C3021B  mov         ebp,esp  </span><br><span class="line">00C3021D  cmp         dword ptr [ebp+8],0  </span><br><span class="line">00C30221  jmp         gum_test_target_function+7h (0D6FB97h) // 跳回原函数，因为写跳转用了7字节，所以+7</span><br></pre></td></tr></table></figure>

<h6 id="gum-interceptor-transaction-end"><a href="#gum-interceptor-transaction-end" class="headerlink" title="gum_interceptor_transaction_end"></a>gum_interceptor_transaction_end</h6><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">// 当前 transaction 添加到 任务中， 设置回调 函数 gum_interceptor_activate 拦截器激活函数</span></span><br><span class="line">  gum_interceptor_transaction_schedule_prologue_write (</span><br><span class="line">      &amp;self-&gt;current_transaction, ctx, gum_interceptor_activate);</span><br></pre></td></tr></table></figure>

<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">// 拦截器激活</span></span><br><span class="line"><span class="keyword">static</span> <span class="keyword">void</span></span><br><span class="line">gum_interceptor_activate (GumInterceptor * self,</span><br><span class="line">                          GumFunctionContext * ctx,</span><br><span class="line">                          gpointer prologue)</span><br><span class="line">&#123;</span><br><span class="line">  <span class="keyword">if</span> (ctx-&gt;destroyed)</span><br><span class="line">    <span class="keyword">return</span>;</span><br><span class="line"></span><br><span class="line">  g_assert (!ctx-&gt;activated);</span><br><span class="line">  ctx-&gt;activated = TRUE;</span><br><span class="line"></span><br><span class="line">  <span class="comment">// 激活</span></span><br><span class="line">  _gum_interceptor_backend_activate_trampoline (self-&gt;backend, ctx,</span><br><span class="line">      prologue);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br></pre></td><td class="code"><pre><span class="line">_gum_interceptor_backend_activate_trampoline (GumInterceptorBackend * self,</span><br><span class="line">                                              GumFunctionContext * ctx,</span><br><span class="line">                                              gpointer prologue)</span><br><span class="line">&#123;</span><br><span class="line">  GumX86Writer * cw = &amp;self-&gt;writer;</span><br><span class="line">  guint padding;</span><br><span class="line"></span><br><span class="line">  <span class="comment">// 设置base</span></span><br><span class="line">  gum_x86_writer_reset (cw, prologue);</span><br><span class="line">  <span class="comment">// 设置pc</span></span><br><span class="line">  cw-&gt;pc = GPOINTER_TO_SIZE (ctx-&gt;function_address);</span><br><span class="line">  <span class="comment">// 写jmp， 跳转到 跳板中， 进入跳板这已经到hook里了</span></span><br><span class="line">  gum_x86_writer_put_jmp_address (cw, GUM_ADDRESS (ctx-&gt;on_enter_trampoline));</span><br><span class="line">  gum_x86_writer_flush (cw);</span><br><span class="line">  g_assert_cmpint (gum_x86_writer_offset (cw),</span><br><span class="line">      &lt;=, GUM_INTERCEPTOR_REDIRECT_CODE_SIZE);</span><br><span class="line"></span><br><span class="line">  <span class="comment">// 原本代码（hook点），剩余的地方nop补齐</span></span><br><span class="line">  padding = ctx-&gt;overwritten_prologue_len - gum_x86_writer_offset (cw);</span><br><span class="line">  <span class="keyword">for</span> (; padding != <span class="number">0</span>; padding--)</span><br><span class="line">    gum_x86_writer_put_nop (cw);</span><br><span class="line">  gum_x86_writer_flush (cw);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<h4 id="2-2-3-执行流程"><a href="#2-2-3-执行流程" class="headerlink" title="2.2.3 执行流程"></a>2.2.3 执行流程</h4><p>通过设置函数返回地址(<code>__gum_function_context_begin/end_invocation</code>)，控制流程，这就是ROP：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">原函数</span><br><span class="line">----------------------------------------------------</span><br><span class="line">跳板 02C80204</span><br><span class="line">----------------------------------------------------</span><br><span class="line">`enter_chunk`  // 首先要保存现场, 构造栈帧，随后进入下一个函数 ⬇️</span><br><span class="line">`__gum_function_context_begin_invocation` // 通过设置栈(ret addr)控制执行流程 </span><br><span class="line">----------------------------------------------------</span><br><span class="line">replacement_function</span><br><span class="line">----------------------------------------------------</span><br><span class="line">跳板 02C8020F</span><br><span class="line">----------------------------------------------------</span><br><span class="line">`leave_chunk`</span><br><span class="line">`__gum_function_context_end_invocation` </span><br><span class="line">----------------------------------------------------</span><br><span class="line">继续执行</span><br></pre></td></tr></table></figure>

<h2 id="0x03-调试分析帮助理解"><a href="#0x03-调试分析帮助理解" class="headerlink" title="0x03 : 调试分析帮助理解"></a>0x03 : 调试分析帮助理解</h2><p>这里调试了单元测试中写hook和函数替换的逻辑，过程如下：</p>
<p><code>_gum_interceptor_backend_create()</code></p>
<p>后端初始化，初始化两个thunk</p>
<p>enter_thunk</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br></pre></td><td class="code"><pre><span class="line">00C30000  pushfd  </span><br><span class="line">00C30001  cld  </span><br><span class="line">00C30002  pushad  </span><br><span class="line">00C30003  lea         esp,[esp-4]  </span><br><span class="line">00C3000A  lea         eax,[esp+2Ch]  </span><br><span class="line">00C30011  mov         dword ptr [esp+10h],eax  </span><br><span class="line">00C30015  mov         ebx,dword ptr [esp+28h]  </span><br><span class="line">00C30019  mov         ebp,esp  </span><br><span class="line">00C3001B  and         esp,0FFFFFFF0h  </span><br><span class="line">00C30021  sub         esp,200h  </span><br><span class="line">00C30027  fxsave      [esp]  </span><br><span class="line">00C3002B  lea         esi,[ebp]  </span><br><span class="line">00C30031  lea         edx,[ebp+2Ch]  </span><br><span class="line">00C30037  lea         ecx,[ebp+28h]  </span><br><span class="line">00C3003D  push        ecx  </span><br><span class="line">00C3003E  push        edx  </span><br><span class="line">00C3003F  push        esi  </span><br><span class="line">00C30040  push        ebx  </span><br><span class="line">00C30041  call        __gum_function_context_begin_invocation (0CE8E1Fh)  </span><br><span class="line">00C30046  add         esp,10h  </span><br><span class="line">00C30049  fxrstor     [esp]  </span><br><span class="line">00C3004D  mov         esp,ebp  </span><br><span class="line">00C3004F  lea         esp,[esp+4]  </span><br><span class="line">00C30056  popad  </span><br><span class="line">00C30057  popfd  </span><br><span class="line">00C30058  ret</span><br></pre></td></tr></table></figure>


<p>leave_thunk</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br></pre></td><td class="code"><pre><span class="line">00C30100  pushfd  </span><br><span class="line">00C30101  cld  </span><br><span class="line">00C30102  pushad  </span><br><span class="line">00C30103  lea         esp,[esp-4]  </span><br><span class="line">00C3010A  lea         eax,[esp+28h]  </span><br><span class="line">00C30111  mov         dword ptr [esp+10h],eax  </span><br><span class="line">00C30115  mov         ebx,dword ptr [esp+28h]  </span><br><span class="line">00C30119  mov         ebp,esp  </span><br><span class="line">00C3011B  and         esp,0FFFFFFF0h  </span><br><span class="line">00C30121  sub         esp,200h  </span><br><span class="line">00C30127  fxsave      [esp]  </span><br><span class="line">00C3012B  lea         esi,[ebp]  </span><br><span class="line">00C30131  lea         edx,[ebp+28h]  </span><br><span class="line">00C30137  sub         esp,4  </span><br><span class="line">00C3013A  push        edx  </span><br><span class="line">00C3013B  push        esi  </span><br><span class="line">00C3013C  push        ebx  </span><br><span class="line">00C3013D  call        __gum_function_context_end_invocation (0CEAB1Bh)  </span><br><span class="line">00C30142  add         esp,0Ch  </span><br><span class="line">00C30145  add         esp,4  </span><br><span class="line">00C30148  fxrstor     [esp]  </span><br><span class="line">00C3014C  mov         esp,ebp  </span><br><span class="line">00C3014E  lea         esp,[esp+4]  </span><br><span class="line">00C30155  popad  </span><br><span class="line">00C30156  popfd  </span><br><span class="line">00C30157  ret</span><br></pre></td></tr></table></figure>

<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">// hook 构造</span></span><br><span class="line">GumAttachReturn</span><br><span class="line">gum_interceptor_attach (GumInterceptor * self,</span><br><span class="line">                        gpointer function_address,</span><br><span class="line">                        GumInvocationListener * listener,</span><br><span class="line">                        gpointer listener_function_data)</span><br></pre></td></tr></table></figure>

<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br></pre></td><td class="code"><pre><span class="line">GumAttachReturn</span><br><span class="line">gum_interceptor_attach (GumInterceptor * self,</span><br><span class="line">                        gpointer function_address,</span><br><span class="line">                        GumInvocationListener * listener,</span><br><span class="line">                        gpointer listener_function_data)</span><br><span class="line">&#123;</span><br><span class="line">  GumAttachReturn result = GUM_ATTACH_OK;</span><br><span class="line">  GumFunctionContext * function_ctx;</span><br><span class="line"></span><br><span class="line">  <span class="keyword">if</span> (gum_process_get_code_signing_policy () == GUM_CODE_SIGNING_REQUIRED)</span><br><span class="line">    <span class="keyword">goto</span> policy_violation;</span><br><span class="line"></span><br><span class="line">  gum_interceptor_ignore_current_thread (self);</span><br><span class="line">  GUM_INTERCEPTOR_LOCK (self);</span><br><span class="line">  gum_interceptor_transaction_begin (&amp;self-&gt;current_transaction);</span><br><span class="line">  self-&gt;current_transaction.is_dirty = TRUE;</span><br><span class="line">4</span><br><span class="line">  <span class="comment">// 获取hook目标函数的地址 </span></span><br><span class="line">  function_address = gum_interceptor_resolve (self, function_address);</span><br><span class="line">  </span><br><span class="line">  <span class="comment">// 获取这个函数的 GumFunctionContext 对象</span></span><br><span class="line">  <span class="comment">// 没有就新建一个</span></span><br><span class="line">  <span class="comment">// 这里已经 准备好了跳板，写好了hook</span></span><br><span class="line">  <span class="comment">// 添加任务,设置相对应的回调函数</span></span><br><span class="line">  function_ctx = gum_interceptor_instrument (self, function_address);</span><br><span class="line">  <span class="keyword">if</span> (function_ctx == <span class="literal">NULL</span>)</span><br><span class="line">    <span class="keyword">goto</span> wrong_signature;</span><br><span class="line"></span><br><span class="line">  <span class="keyword">if</span> (gum_function_context_has_listener (function_ctx, listener))</span><br><span class="line">    <span class="keyword">goto</span> already_attached;</span><br><span class="line">  <span class="comment">// 添加监听器</span></span><br><span class="line">  gum_function_context_add_listener (function_ctx, listener,</span><br><span class="line">      listener_function_data);</span><br><span class="line"></span><br><span class="line">  <span class="keyword">goto</span> beach;</span><br><span class="line"></span><br><span class="line">policy_violation:</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="keyword">return</span> GUM_ATTACH_POLICY_VIOLATION;</span><br><span class="line">  &#125;</span><br><span class="line">wrong_signature:</span><br><span class="line">  &#123;</span><br><span class="line">    result = GUM_ATTACH_WRONG_SIGNATURE;</span><br><span class="line">    <span class="keyword">goto</span> beach;</span><br><span class="line">  &#125;</span><br><span class="line">already_attached:</span><br><span class="line">  &#123;</span><br><span class="line">    result = GUM_ATTACH_ALREADY_ATTACHED;</span><br><span class="line">    <span class="keyword">goto</span> beach;</span><br><span class="line">  &#125;</span><br><span class="line">beach:</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="comment">// 到这里，基本没什么问题，hook什么都打好了</span></span><br><span class="line">    <span class="comment">// 拦截器激活 跳板激活</span></span><br><span class="line">    <span class="comment">// 这里把原函数开头改写</span></span><br><span class="line">    gum_interceptor_transaction_end (&amp;self-&gt;current_transaction);</span><br><span class="line">    GUM_INTERCEPTOR_UNLOCK (self);</span><br><span class="line">    gum_interceptor_unignore_current_thread (self);</span><br><span class="line"></span><br><span class="line">    <span class="keyword">return</span> result;</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>on_invoke_trampoline 跳板</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">00C30200  mov         al,byte ptr ds:[FF00C121h]  </span><br><span class="line">00C30205  xor         eax,0C30200h  </span><br><span class="line">00C3020A  jmp         00C30000   // 跳到上面的 enter_thunk</span><br><span class="line">00C3020F  push        dword ptr ds:[0C30200h]  </span><br><span class="line">00C30215  jmp         00C30100  // 跳到 leave_thunk</span><br><span class="line">// 原函数修复的指令，7个字节</span><br><span class="line">00C3021A  push        ebp  </span><br><span class="line">00C3021B  mov         ebp,esp  </span><br><span class="line">00C3021D  cmp         dword ptr [ebp+8],0  </span><br><span class="line">00C30221  jmp         gum_test_target_function+7h (0D6FB97h) // 跳回原函数，因为写跳转用了7字节，所以+7</span><br></pre></td></tr></table></figure>



<p><code>gum_interceptor_transaction_end (&amp;self-&gt;current_transaction);</code> 调用 <code>gum_interceptor_activate()</code> 然后<code>_gum_interceptor_backend_activate_trampolie()</code> 随后，目标函数开头被修改：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">gpointer GUM_NOINLINE</span><br><span class="line">gum_test_target_function (GString * str)</span><br><span class="line">&#123;</span><br><span class="line"><span class="number">00</span>D6FB90  jmp         <span class="number">00</span>C30204  </span><br><span class="line">  <span class="keyword">if</span> (str != <span class="literal">NULL</span>)</span><br><span class="line"><span class="number">00</span>D6FB95  nop  </span><br><span class="line"><span class="number">00</span>D6FB96  nop  </span><br><span class="line"><span class="number">00</span>D6FB97  je          gum_test_target_function+<span class="number">19</span>h (<span class="number">0</span>D6FBA9h)</span><br></pre></td></tr></table></figure>

<p>直接跳转到 <code>00C30204</code>, 其实就是 跳板，因为反汇编的地址差了点，所以开始的指令不太一样:</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line">00C30204  push        dword ptr ds:[0C30200h]  </span><br><span class="line">00C3020A  jmp         00C30000  </span><br><span class="line">00C3020F  push        dword ptr ds:[0C30200h]  </span><br><span class="line">00C30215  jmp         00C30100  </span><br><span class="line">00C3021A  push        ebp  </span><br><span class="line">00C3021B  mov         ebp,esp  </span><br><span class="line">00C3021D  cmp         dword ptr [ebp+8],0  </span><br><span class="line">00C30221  jmp         gum_test_target_function+7h (0D6FB97h)  </span><br><span class="line">00C30226  add         byte ptr [eax],al  </span><br><span class="line">00C30228  add         byte ptr [eax],al  </span><br><span class="line">00C3022A  add         byte ptr [eax],al  </span><br><span class="line">00C3022C  add         byte ptr [eax],al  </span><br><span class="line">00C3022E  add         byte ptr [eax],al</span><br></pre></td></tr></table></figure>

<p>调用流程调试分析，这里分两个情况，是否存在``replacement_function`</p>
<p>首先是不存在，只是打个hook(根据 <code>TESTCASE(attach_one);</code>)</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line">call 原函数</span><br><span class="line">----------------------------------------------------</span><br><span class="line">原函数</span><br><span class="line">----------------------------------------------------</span><br><span class="line">跳板</span><br><span class="line">----------------------------------------------------</span><br><span class="line">`enter_chunk`  // 首先要保存现场, 构造栈帧，随后进入下一个函数 ⬇️</span><br><span class="line">`__gum_function_context_begin_invocation` // 通过设置栈(ret addr)控制执行流程 </span><br><span class="line">----------------------------------------------------</span><br><span class="line">跳板+n  (00C3021A) // 执行原函数的 修复的若干字节</span><br><span class="line">----------------------------------------------------</span><br><span class="line">原函数</span><br><span class="line">----------------------------------------------------</span><br><span class="line">`leave_chunk` </span><br><span class="line">`__gum_function_context_end_invocation`</span><br><span class="line">----------------------------------------------------</span><br><span class="line">继续执行....</span><br></pre></td></tr></table></figure>

<p>存在替换的函数(<code>TESTCASE(replace_one);</code>)</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">原函数</span><br><span class="line">----------------------------------------------------</span><br><span class="line">跳板 02C80204</span><br><span class="line">----------------------------------------------------</span><br><span class="line">`enter_chunk`  // 首先要保存现场, 构造栈帧，随后进入下一个函数 ⬇️</span><br><span class="line">`__gum_function_context_begin_invocation` // 通过设置栈(ret addr)控制执行流程 </span><br><span class="line">----------------------------------------------------</span><br><span class="line">replacement_function</span><br><span class="line">----------------------------------------------------</span><br><span class="line">跳板 02C8020F</span><br><span class="line">----------------------------------------------------</span><br><span class="line">`leave_chunk`</span><br><span class="line">`__gum_function_context_end_invocation` </span><br><span class="line">----------------------------------------------------</span><br><span class="line">继续执行</span><br></pre></td></tr></table></figure>

<p>replace_one 的跳板</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">02C80204  push        dword ptr ds:[2C80200h]  </span><br><span class="line">02C8020A  jmp         02C80000  </span><br><span class="line">02C8020F  push        dword ptr ds:[2C80200h]  </span><br><span class="line">02C80215  jmp         02C80100  </span><br><span class="line">02C8021A  mov         edi,edi  </span><br><span class="line">02C8021C  push        ebp  </span><br><span class="line">02C8021D  mov         ebp,esp  </span><br><span class="line">02C8021F  jmp         malloc+5h (01E5A7B5h)</span><br></pre></td></tr></table></figure>

<h2 id="0x04-结语"><a href="#0x04-结语" class="headerlink" title="0x04 : 结语"></a>0x04 : 结语</h2><p>这个过程大概花了我一周 5天多的样子，挺难的个人感觉，需要捋清楚的话，配合调试会好很多，最开始我直接看的代码，看+做笔记，脑内debug，最后编译了工程，vs调试，清晰多了，还是建议边调试边看。</p>
<p>如果文中有任何问题，欢迎批评指正  : ) </p>
<p>后面可能会在他基础上做点事情吧…这框架真牛逼 !</p>
<h2 id="0x05-参考与引用"><a href="#0x05-参考与引用" class="headerlink" title="0x05 : 参考与引用"></a>0x05 : 参考与引用</h2><p><a href="https://jmpews.github.io/2017/06/27/pwn/frida-gum源码解读/" target="_blank" rel="noopener"><a href="https://jmpews.github.io/2017/06/27/pwn/frida-gum源码解读/" target="_blank" rel="noopener">rida-gum源码解读</a></a></p>
<p><a href="https://blog.csdn.net/yanbixing123/article/details/52970804" target="_blank" rel="noopener">gobject c语言</a></p>
<p><a href="https://bbs.pediy.com/thread-220794.htm" target="_blank" rel="noopener">如何构建一款像 frida 一样的框架</a></p>

      
    </div>
    
  </div>
  
    
    <div class="copyright">
        <p><span>本文标题:</span><a href="/2019/11/15/frida-gum%E4%BB%A3%E7%A0%81%E9%98%85%E8%AF%BB/">frida-gum代码阅读笔记</a></p>
        <p><span>文章作者:</span><a href="/" title="访问 muhe 的个人博客">muhe</a></p>
        <p><span>发布时间:</span>2019年11月15日 - 17时54分</p>
        <p><span>最后更新:</span>2019年11月15日 - 19时09分</p>
        <p>
            <span>原始链接:</span><a class="post-url" href="/2019/11/15/frida-gum%E4%BB%A3%E7%A0%81%E9%98%85%E8%AF%BB/" title="frida-gum代码阅读笔记">http://o0xmuhe.me/2019/11/15/frida-gum%E4%BB%A3%E7%A0%81%E9%98%85%E8%AF%BB/</a>
            <span class="copy-path" data-clipboard-text="原文: http://o0xmuhe.me/2019/11/15/frida-gum%E4%BB%A3%E7%A0%81%E9%98%85%E8%AF%BB/　　作者: muhe" title="点击复制文章链接"><i class="fa fa-clipboard"></i></span>
            <script src="/js/clipboard.min.js"></script>
            <script> var clipboard = new Clipboard('.copy-path'); </script>
        </p>
        <p>
            <span>许可协议:</span><i class="fa fa-creative-commons"></i> <a rel="license noopener" href="http://creativecommons.org/licenses/by-nc-sa/3.0/cn/" target="_blank" title="中国大陆 (CC BY-NC-SA 3.0 CN)" target = "_blank">"署名-非商用-相同方式共享 3.0"</a> 转载请保留原文链接及作者。
        </p>
    </div>



<nav id="article-nav">
  
  
    <a href="/2019/10/24/Linux-Kernel-%E7%BC%96%E8%AF%91%E8%B8%A9%E5%9D%91/" id="article-nav-older" class="article-nav-link-wrap">
      <div class="article-nav-title">Linux Kernel 编译踩坑</div>
      <strong class="article-nav-caption">></strong>
    </a>
  
</nav>

  
</article>

    <div id="toc" class="toc-article">
    <strong class="toc-title">文章目录</strong>
    <ol class="toc"><li class="toc-item toc-level-2"><a class="toc-link" href="#0x00-前言与预备知识"><span class="toc-number">1.</span> <span class="toc-text">0x00 : 前言与预备知识</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x01-项目构架"><span class="toc-number">2.</span> <span class="toc-text">0x01 : 项目构架</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x02-阅读frida-gum-x86为例"><span class="toc-number">3.</span> <span class="toc-text">0x02 : 阅读frida-gum (x86为例)</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#2-1-构架"><span class="toc-number">3.1.</span> <span class="toc-text">2.1. 构架</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#2-2-代码阅读"><span class="toc-number">3.2.</span> <span class="toc-text">2.2. 代码阅读</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#2-2-1-准备工作"><span class="toc-number">3.2.1.</span> <span class="toc-text">2.2.1 准备工作</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#2-2-2-hook从0到1"><span class="toc-number">3.2.2.</span> <span class="toc-text">2.2.2 hook从0到1</span></a><ol class="toc-child"><li class="toc-item toc-level-5"><a class="toc-link" href="#gum-interceptor-obtain"><span class="toc-number">3.2.2.1.</span> <span class="toc-text">gum_interceptor_obtain()</span></a></li><li class="toc-item toc-level-5"><a class="toc-link" href="#gum-interceptor-attach-listener"><span class="toc-number">3.2.2.2.</span> <span class="toc-text">gum_interceptor_attach_listener</span></a><ol class="toc-child"><li class="toc-item toc-level-6"><a class="toc-link" href="#gum-interceptor-transaction-begin"><span class="toc-number">3.2.2.2.1.</span> <span class="toc-text">gum_interceptor_transaction_begin</span></a></li><li class="toc-item toc-level-6"><a class="toc-link" href="#gum-interceptor-instrument-✨"><span class="toc-number">3.2.2.2.2.</span> <span class="toc-text">gum_interceptor_instrument ✨</span></a></li><li class="toc-item toc-level-6"><a class="toc-link" href="#gum-interceptor-transaction-end"><span class="toc-number">3.2.2.2.3.</span> <span class="toc-text">gum_interceptor_transaction_end</span></a></li></ol></li></ol></li><li class="toc-item toc-level-4"><a class="toc-link" href="#2-2-3-执行流程"><span class="toc-number">3.2.3.</span> <span class="toc-text">2.2.3 执行流程</span></a></li></ol></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x03-调试分析帮助理解"><span class="toc-number">4.</span> <span class="toc-text">0x03 : 调试分析帮助理解</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x04-结语"><span class="toc-number">5.</span> <span class="toc-text">0x04 : 结语</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x05-参考与引用"><span class="toc-number">6.</span> <span class="toc-text">0x05 : 参考与引用</span></a></li></ol>
</div>
<input type="button" id="tocButton" value="隐藏目录"  title="点击按钮隐藏或者显示文章目录">

<script src="https://7.url.cn/edu/jslib/comb/require-2.1.6,jquery-1.9.1.min.js"></script>
<script>
    var valueHide = "隐藏目录";
    var valueShow = "显示目录";

    if ($(".left-col").is(":hidden")) {
        $("#tocButton").attr("value", valueShow);
    }
    $("#tocButton").click(function() {
        if ($("#toc").is(":hidden")) {
            $("#tocButton").attr("value", valueHide);
            $("#toc").slideDown(320);
        }
        else {
            $("#tocButton").attr("value", valueShow);
            $("#toc").slideUp(350);
        }
    })
    if ($(".toc").length < 1) {
        $("#toc, #tocButton").hide();
    }
</script>





<div class="bdsharebuttonbox">
	<a href="#" class="fx fa-weibo bds_tsina" data-cmd="tsina" title="分享到新浪微博"></a>
	<a href="#" class="fx fa-weixin bds_weixin" data-cmd="weixin" title="分享到微信"></a>
	<a href="#" class="fx fa-qq bds_sqq" data-cmd="sqq" title="分享到QQ好友"></a>
	<a href="#" class="fx fa-facebook-official bds_fbook" data-cmd="fbook" title="分享到Facebook"></a>
	<a href="#" class="fx fa-twitter bds_twi" data-cmd="twi" title="分享到Twitter"></a>
	<a href="#" class="fx fa-linkedin bds_linkedin" data-cmd="linkedin" title="分享到linkedin"></a>
	<a href="#" class="fx fa-files-o bds_copy" data-cmd="copy" title="分享到复制网址"></a>
</div>
<script>window._bd_share_config={"common":{"bdSnsKey":{},"bdText":"","bdMini":"2","bdMiniList":false,"bdPic":"","bdStyle":"2","bdSize":"24"},"share":{}};with(document)0[(getElementsByTagName('head')[0]||body).appendChild(createElement('script')).src='/static/api/js/share.js?v=89860593.js?cdnversion='+~(-new Date()/36e5)];</script>




    
        <section id="comments">
  <div id="disqus_thread"></div>
    <script type="text/javascript">
    /* * * CONFIGURATION VARIABLES: EDIT BEFORE PASTING INTO YOUR WEBPAGE * * */
    var disqus_shortname = 'o0xmuhe'; // required: replace example with your forum shortname

    /* * * DON'T EDIT BELOW THIS LINE * * */
    (function() {
      var dsq = document.createElement('script'); dsq.type = 'text/javascript'; dsq.async = true;
      dsq.src = '//' + disqus_shortname + '.disqus.com/embed.js';
      (document.getElementsByTagName('head')[0] || document.getElementsByTagName('body')[0]).appendChild(dsq);
    })();
  </script>
  <noscript>Please enable JavaScript to view the <a href="https://disqus.com/?ref_noscript" target="_blank" rel="noopener">comments powered by Disqus.</a></noscript>
</section>
    



    <div class="scroll" id="post-nav-button">
        
            <a href="/" title="回到主页"><i class="fa fa-home"></i></a>
        
        <a title="文章列表"><i class="fa fa-bars"></i><i class="fa fa-times"></i></a>
        
            <a href="/2019/10/24/Linux-Kernel-%E7%BC%96%E8%AF%91%E8%B8%A9%E5%9D%91/" title="下一篇: Linux Kernel 编译踩坑">
                <i class="fa fa-angle-right"></i>
            </a>
        
    </div>
    <ul class="post-list"><li class="post-list-item"><a class="post-list-link" href="/2019/11/15/frida-gum%E4%BB%A3%E7%A0%81%E9%98%85%E8%AF%BB/">frida-gum代码阅读笔记</a></li><li class="post-list-item"><a class="post-list-link" href="/2019/10/24/Linux-Kernel-%E7%BC%96%E8%AF%91%E8%B8%A9%E5%9D%91/">Linux Kernel 编译踩坑</a></li><li class="post-list-item"><a class="post-list-link" href="/2019/10/17/Debug-macOS-Kernel/">Debug macOS Kernel</a></li><li class="post-list-item"><a class="post-list-link" href="/2019/09/26/Snell-auto-install-cript/">Snell auto install cript</a></li><li class="post-list-item"><a class="post-list-link" href="/2019/09/20/macOS-IPC-Study-basic-2/">macOS IPC Study Notes</a></li><li class="post-list-item"><a class="post-list-link" href="/2019/09/09/Uninitialised-Objective-C-Pointer-Vulnerability-Analysis-CVE-2018-4196/">Uninitialised Objective-C Pointer Vulnerability Analysis (CVE-2018-4196)</a></li><li class="post-list-item"><a class="post-list-link" href="/2019/09/02/CVE-2019-8604-analysis/">CVE-2019-8604 analysis</a></li><li class="post-list-item"><a class="post-list-link" href="/2019/08/22/Bindiff5-0-Could-not-create-file-handler-fix/">Bindiff5.0 Could not create file handler fix</a></li><li class="post-list-item"><a class="post-list-link" href="/2019/08/20/macOS-IPC-Study-basic/">macOS IPC Study basic</a></li><li class="post-list-item"><a class="post-list-link" href="/2019/08/14/Adobe-Acrobat-Reader-getUIPerms-setUIPerms-Unicode-String-Out-of-bound-Read/">Adobe Acrobat Reader getUIPerms/setUIPerms  Unicode String Out-of-bound Read</a></li><li class="post-list-item"><a class="post-list-link" href="/2019/08/10/Apple-IPC-DO-Basic/">Apple IPC : DO Basic</a></li><li class="post-list-item"><a class="post-list-link" href="/2019/07/16/Adobe-Acrobat-DC-Pro-touchup-UaF/">Adobe Acrobat DC Pro touchup UaF</a></li><li class="post-list-item"><a class="post-list-link" href="/2019/07/09/IDA%E8%87%AA%E5%8A%A8%E5%8C%96%E5%88%86%E6%9E%90/">IDA自动化分析</a></li><li class="post-list-item"><a class="post-list-link" href="/2019/06/19/CVE-2017-2541-XGetWindowMovementGroup-stackoverflow/">CVE-2017-2541 __XGetWindowMovementGroup stackoverflow</a></li><li class="post-list-item"><a class="post-list-link" href="/2019/06/19/CVE-2017-2540-XGetConnectionPSN-info-leak/">CVE-2017-2540 _XGetConnectionPSN info leak</a></li><li class="post-list-item"><a class="post-list-link" href="/2019/06/14/find-macOS-service-and-it-s-plist-file/">find macOS service and it's plist file</a></li><li class="post-list-item"><a class="post-list-link" href="/2019/05/15/Adobe-Acrobat-DC-Pro-OOB-CVE-2019-7813/">Adobe Acrobat DC Pro OOB(CVE-2019-7813)</a></li><li class="post-list-item"><a class="post-list-link" href="/2019/05/10/macOS-on-ESXi/">macOS on ESXi</a></li><li class="post-list-item"><a class="post-list-link" href="/2019/04/20/CVE-2017-2547-%E5%88%86%E6%9E%90/">CVE-2017-2547 分析</a></li><li class="post-list-item"><a class="post-list-link" href="/2019/04/17/NULL/">NULL</a></li><li class="post-list-item"><a class="post-list-link" href="/2019/04/12/CVE-2019-7125-PoC/">CVE-2019-7125 PoC</a></li><li class="post-list-item"><a class="post-list-link" href="/2019/04/06/CVE-2018-4990-analysis/">CVE-2018-4990 analysis</a></li><li class="post-list-item"><a class="post-list-link" href="/2019/04/06/CVE-2016-4622-analysis/">CVE-2016-4622  analysis</a></li><li class="post-list-item"><a class="post-list-link" href="/2019/03/24/CVE-2017-2536-analysis/">CVE-2017-2536 analysis</a></li><li class="post-list-item"><a class="post-list-link" href="/2019/03/12/CVE-2018-12794-%E5%88%86%E6%9E%90/">CVE-2018-12794 分析</a></li><li class="post-list-item"><a class="post-list-link" href="/2019/01/04/%E4%BD%BF%E7%94%A8Frida%E8%BE%85%E5%8A%A9%E9%80%86%E5%90%91/">使用Frida辅助逆向</a></li><li class="post-list-item"><a class="post-list-link" href="/2018/12/31/Webkit%E7%BC%96%E8%AF%91%E8%B8%A9%E5%9D%91%E8%AE%B0%E5%BD%95/">Webkit编译踩坑记录</a></li><li class="post-list-item"><a class="post-list-link" href="/2018/12/25/%E9%80%86%E5%90%91%E5%8D%8F%E4%BD%9C%E4%B9%8BIDA%E6%8F%92%E4%BB%B6IDArling/">逆向协作之IDA插件IDArling</a></li><li class="post-list-item"><a class="post-list-link" href="/2018/12/13/%E7%94%B1CVE-2018-12831%E5%BC%95%E5%8F%91%E7%9A%84%E4%B8%80%E4%BA%9B%E6%80%9D%E8%80%83/">由CVE-2018-12831引发的一些思考</a></li><li class="post-list-item"><a class="post-list-link" href="/2018/11/18/TFC%E6%B8%B8%E8%AE%B0/">TFC游记</a></li><li class="post-list-item"><a class="post-list-link" href="/2018/11/08/Hello-PANDA/">Hello PANDA</a></li><li class="post-list-item"><a class="post-list-link" href="/2018/11/07/UAF-analysis-using-pykd/">UAF analysis : using pykd</a></li><li class="post-list-item"><a class="post-list-link" href="/2018/10/05/%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1%E5%9F%B9%E5%85%BB%E8%AE%A1%E5%88%92/">代码审计培养计划</a></li><li class="post-list-item"><a class="post-list-link" href="/2018/08/13/%E9%A3%9E%E6%89%AC%E5%8E%86%E9%99%A9%E8%AE%B0/">飞扬历险记</a></li><li class="post-list-item"><a class="post-list-link" href="/2018/06/16/linux-code-inject/">linux code inject</a></li><li class="post-list-item"><a class="post-list-link" href="/2018/06/16/%E6%AF%94%E8%B5%9B%E8%BF%90%E7%BB%B4%E6%9D%82%E8%AE%B0/">比赛运维杂记</a></li><li class="post-list-item"><a class="post-list-link" href="/2018/06/09/%E8%AE%BA%E6%96%87%E9%98%85%E8%AF%BB-IFuzzer-An-Evolutionary-Interpreter-Fuzzer-using-Genetic-Programming/">论文阅读<IFuzzer: An Evolutionary Interpreter Fuzzer using Genetic Programming></a></li><li class="post-list-item"><a class="post-list-link" href="/2018/06/03/%E9%81%97%E4%BC%A0%E7%AE%97%E6%B3%95%E5%88%9D%E7%AA%A5/">遗传算法初窥</a></li><li class="post-list-item"><a class="post-list-link" href="/2018/05/29/Antlr4%E5%88%9D%E4%BD%93%E9%AA%8C/">Antlr4初体验</a></li><li class="post-list-item"><a class="post-list-link" href="/2018/04/19/mips%E7%A8%8B%E5%BA%8F%E8%B0%83%E8%AF%95%E7%8E%AF%E5%A2%83%E6%8A%98%E8%85%BE/">mips程序调试环境折腾</a></li><li class="post-list-item"><a class="post-list-link" href="/2018/03/14/%E6%8B%AF%E6%95%91macOS-High-sierra%E7%9A%84%E7%A1%AC%E7%9B%98%E7%A9%BA%E9%97%B4/">拯救macOS High sierra的硬盘空间</a></li><li class="post-list-item"><a class="post-list-link" href="/2018/02/16/Symbolic-Execution%E5%AD%A6%E4%B9%A0/">Symbolic Execution学习</a></li><li class="post-list-item"><a class="post-list-link" href="/2018/02/11/LL-LR-SLR-LALR%E5%82%BB%E5%82%BB%E5%88%86%E4%B8%8D%E6%B8%85/">LL LR SLR LALR傻傻分不清</a></li><li class="post-list-item"><a class="post-list-link" href="/2018/01/20/compiler%E5%AD%A6%E4%B9%A0/">compiler学习</a></li><li class="post-list-item"><a class="post-list-link" href="/2018/01/15/Unicorn-Engine%E5%88%9D%E4%BD%93%E9%AA%8C/">Unicorn Engine初体验</a></li><li class="post-list-item"><a class="post-list-link" href="/2018/01/06/flex-bison%E8%AF%BB%E4%B9%A6%E7%AC%94%E8%AE%B0/">flex_bison读书笔记</a></li><li class="post-list-item"><a class="post-list-link" href="/2017/12/30/Python%E6%8C%87%E5%AE%9A%E6%A6%82%E7%8E%87%E8%8E%B7%E5%8F%96%E9%9A%8F%E6%9C%BA%E5%85%83%E7%B4%A0/">Python指定概率获取随机元素</a></li><li class="post-list-item"><a class="post-list-link" href="/2017/10/01/Hello-World%E5%8D%87%E7%BA%A7%E7%89%88/">Hello World升级版</a></li><li class="post-list-item"><a class="post-list-link" href="/2017/07/13/babydriver-writeup/">babydriver writeup</a></li><li class="post-list-item"><a class="post-list-link" href="/2017/07/05/OpenGrok%E6%90%AD%E5%BB%BA/">OpenGrok搭建</a></li><li class="post-list-item"><a class="post-list-link" href="/2017/06/30/%E7%BC%96%E8%AF%91%E5%8E%9F%E7%90%86%E5%AD%A6%E4%B9%A0/">编译原理学习</a></li><li class="post-list-item"><a class="post-list-link" href="/2017/06/28/TrendMicro-CTF-2017-Reverse300/">TrendMicro CTF 2017 Reverse300</a></li><li class="post-list-item"><a class="post-list-link" href="/2017/06/19/Final/">Final</a></li><li class="post-list-item"><a class="post-list-link" href="/2017/05/29/pwnhub%E6%9D%AFCUIT%E7%AC%AC%E5%8D%81%E4%B8%89%E5%B1%8A%E6%A0%A1%E8%B5%9Bpwn%E5%87%BA%E9%A2%98%E5%8F%8A%E8%BF%90%E7%BB%B4%E5%BF%83%E5%BE%97/">pwnhub杯CUIT第十三届校赛pwn出题及运维心得</a></li><li class="post-list-item"><a class="post-list-link" href="/2017/05/08/SSCTF-2017%E9%83%A8%E5%88%86Writeup/">SSCTF-2017部分Writeup</a></li><li class="post-list-item"><a class="post-list-link" href="/2017/04/22/360%E6%98%A5%E7%A7%8BCTF-pwn/">360春秋CTF--pwn</a></li><li class="post-list-item"><a class="post-list-link" href="/2017/04/06/Linux-Kernel-Exploit-4-beginners/">Linux Kernel Exploit 4 beginners</a></li><li class="post-list-item"><a class="post-list-link" href="/2017/03/15/NJCTF-2017%E9%83%A8%E5%88%86wp/">NJCTF-2017部分wp</a></li><li class="post-list-item"><a class="post-list-link" href="/2017/03/06/SECCON-2016-jmper/">SECCON-2016 jmper</a></li><li class="post-list-item"><a class="post-list-link" href="/2017/03/04/codegate2017-angrybird/">codegate2017-angrybird</a></li><li class="post-list-item"><a class="post-list-link" href="/2017/02/27/LLVM-Study-Log/">LLVM Study Log</a></li><li class="post-list-item"><a class="post-list-link" href="/2017/02/16/ichunqiu-CTF-2017-2/">ichunqiu-CTF-2017-2</a></li><li class="post-list-item"><a class="post-list-link" href="/2017/02/08/Adding-your-own-syscall-in-linux-kernel/">Adding your own syscall in linux kernel</a></li><li class="post-list-item"><a class="post-list-link" href="/2017/02/04/Windows-Kernel-Exploit-Study-3/">Windows-Kernel-Exploit-Study(3)</a></li><li class="post-list-item"><a class="post-list-link" href="/2017/01/30/Linux%20socket%E8%BF%9B%E7%A8%8B%E9%97%B4%E9%80%9A%E4%BF%A1%E5%8F%8A%E5%BA%94%E7%94%A8/">Linux socket进程间通信及应用</a></li><li class="post-list-item"><a class="post-list-link" href="/2017/01/28/%E9%97%B2%E8%A8%80%E7%A2%8E%E8%AF%AD/">闲言碎语</a></li><li class="post-list-item"><a class="post-list-link" href="/2017/01/22/Have-fun-with-Blind-ROP/">Have fun with Blind ROP</a></li><li class="post-list-item"><a class="post-list-link" href="/2017/01/20/Windows-Kernel-Exploit-Study-2/">Windows Kernel Exploit Study(2)</a></li><li class="post-list-item"><a class="post-list-link" href="/2017/01/19/Windows-Kernel-Exploit-Study-1/">Windows Kernel Exploit Study(1)</a></li><li class="post-list-item"><a class="post-list-link" href="/2016/12/24/what-DynELF-does-basically/">what DynELF does basically</a></li><li class="post-list-item"><a class="post-list-link" href="/2016/12/17/fuzzing-with-peach-Just-a-toy/">fuzzing with peach(Just a toy)</a></li><li class="post-list-item"><a class="post-list-link" href="/2016/11/25/PlaidCTF-2016-butterfly/">PlaidCTF 2016 butterfly</a></li><li class="post-list-item"><a class="post-list-link" href="/2016/11/21/Have-fun-with-glibc%E5%86%85%E5%AD%98%E7%AE%A1%E7%90%86/">Have fun with glibc内存管理</a></li><li class="post-list-item"><a class="post-list-link" href="/2016/11/10/linux-%E4%B8%8B%E8%B5%B7shell%E5%A4%B1%E8%B4%A5%E7%9A%84%E5%88%86%E6%9E%90/">linux 下起shell失败的分析</a></li><li class="post-list-item"><a class="post-list-link" href="/2016/11/07/Baiudu%E6%9D%AF-pwn%E4%B8%93%E5%9C%BA%E8%AE%B0%E5%BD%95/">Baiudu杯 pwn专场记录</a></li><li class="post-list-item"><a class="post-list-link" href="/2016/10/29/how-to-compile-WinAFL/">how to compile WinAFL</a></li><li class="post-list-item"><a class="post-list-link" href="/2016/10/25/yocto-writeup/">yocto writeup</a></li><li class="post-list-item"><a class="post-list-link" href="/2016/10/11/HITCON-2016-Quals-SecretHolder/">HITCON-2016-Quals-SecretHolder</a></li><li class="post-list-item"><a class="post-list-link" href="/2016/09/27/BCTF-cloud/">BCTF--cloud</a></li><li class="post-list-item"><a class="post-list-link" href="/2016/09/24/%E4%B8%80%E4%BA%9B%E7%8E%AF%E5%A2%83%E9%85%8D%E7%BD%AE%E9%81%87%E5%88%B0%E7%9A%84%E5%9D%91-%E6%8C%81%E7%BB%AD%E6%9B%B4%E6%96%B0/">一些环境配置遇到的坑(持续更新)</a></li><li class="post-list-item"><a class="post-list-link" href="/2016/09/16/Malloc-Maleficarum-%E5%A4%8D%E7%9B%98/">Malloc-Maleficarum-复盘</a></li><li class="post-list-item"><a class="post-list-link" href="/2016/08/26/%E5%88%9D%E8%AF%95winafl/">初试winafl</a></li><li class="post-list-item"><a class="post-list-link" href="/2016/08/14/pwnable-kr-alloca/">pwnable.kr -- alloca</a></li><li class="post-list-item"><a class="post-list-link" href="/2016/08/01/%E7%AE%80%E5%8D%95%E7%9A%84%E5%B0%9D%E8%AF%95angr/">简单的尝试angr</a></li><li class="post-list-item"><a class="post-list-link" href="/2016/06/29/%E7%AC%AC%E4%B8%80%E4%B8%AAandroid-cm%E8%B0%83%E8%AF%95%E5%88%86%E6%9E%90/">第一个android cm调试分析</a></li><li class="post-list-item"><a class="post-list-link" href="/2016/06/29/install-gef/">install gef</a></li><li class="post-list-item"><a class="post-list-link" href="/2016/04/30/cctf-pwn350/">cctf pwn350</a></li><li class="post-list-item"><a class="post-list-link" href="/2016/02/15/heap-vuln-unlink/">heap vuln -- unlink</a></li><li class="post-list-item"><a class="post-list-link" href="/2015/12/02/format-string-with-stack-frame/">format string with stack frame</a></li><li class="post-list-item"><a class="post-list-link" href="/2015/11/16/RCTF-PWN200/">RCTF -- PWN200</a></li><li class="post-list-item"><a class="post-list-link" href="/2015/11/05/dragon/">dragon</a></li></ul>
    <script src="https://7.url.cn/edu/jslib/comb/require-2.1.6,jquery-1.9.1.min.js"></script>
    <script>
        $(".post-list").addClass("toc-article");
        $(".post-list-item a").attr("target","_blank");
        $("#post-nav-button > a:nth-child(2)").click(function() {
            $(".fa-bars, .fa-times").toggle();
            $(".post-list").toggle(300);
            if ($(".toc").length > 0) {
                $("#toc, #tocButton").toggle(200, function() {
                    if ($(".switch-area").is(":visible")) {
                        $("#tocButton").attr("value", valueHide);
                        }
                    })
            }
            else {
            }
        })
    </script>



    <script>
        
    </script>
</div>
      <footer id="footer">
    <div class="outer">
        <div id="footer-info">
            <div class="footer-left">
                &copy; 2019 muhe
            </div>
            <div class="footer-right">
                <a href="http://hexo.io/" target="_blank">Hexo</a>  Theme <a href="https://github.com/luuman/hexo-theme-spfk" target="_blank">spfk</a> by luuman
            </div>
        </div>
        
            <div class="visit">
                
                    <span id="busuanzi_container_site_pv" style='display:none'>
                        <span id="site-visit" >访客数量: 
                            <span id="busuanzi_value_site_uv"></span>
                        </span>
                    </span>
                
                
                    <span>, </span>
                
                
                    <span id="busuanzi_container_page_pv" style='display:none'>
                        <span id="page-visit">本页阅读量: 
                            <span id="busuanzi_value_page_pv"></span>
                        </span>
                    </span>
                
            </div>
        
    </div>
</footer>

    </div>
    <script src="https://7.url.cn/edu/jslib/comb/require-2.1.6,jquery-1.9.1.min.js"></script>
<script src="/js/main.js"></script>

    <script>
        $(document).ready(function() {
            var backgroundnum = 24;
            var backgroundimg = "url(/background/bg-x.jpg)".replace(/x/gi, Math.ceil(Math.random() * backgroundnum));
            $("#mobile-nav").css({"background-image": backgroundimg,"background-size": "cover","background-position": "center"});
            $(".left-col").css({"background-image": backgroundimg,"background-size": "cover","background-position": "center"});
        })
    </script>





<div class="scroll" id="scroll">
    <a href="#"><i class="fa fa-arrow-up"></i></a>
    <a href="#comments"><i class="fa fa-comments-o"></i></a>
    <a href="#footer"><i class="fa fa-arrow-down"></i></a>
</div>
<script>
    $(document).ready(function() {
        if ($("#comments").length < 1) {
            $("#scroll > a:nth-child(2)").hide();
        };
    })
</script>

<script async src="https://dn-lbstatics.qbox.me/busuanzi/2.3/busuanzi.pure.mini.js">
</script>

  <script language="javascript">
    $(function() {
        $("a[title]").each(function() {
            var a = $(this);
            var title = a.attr('title');
            if (title == undefined || title == "") return;
            a.data('title', title).removeAttr('title').hover(

            function() {
                var offset = a.offset();
                $("<div id=\"anchortitlecontainer\"></div>").appendTo($("body")).html(title).css({
                    top: offset.top - a.outerHeight() - 15,
                    left: offset.left + a.outerWidth()/2 + 1
                }).fadeIn(function() {
                    var pop = $(this);
                    setTimeout(function() {
                        pop.remove();
                    }, pop.text().length * 800);
                });
            }, function() {
                $("#anchortitlecontainer").remove();
            });
        });
    });
</script>


  </div>
</body>
</html>